EUVD-2026-123405

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...